PalletMath scores liquidation pallets. To do that it needs your manifests and, if you choose, your own sales history. It does not need anything about your customers, and it does not take it.
PalletMath D&D LLC, a Pennsylvania limited liability company, operates PalletMath at palletmath.com and app.palletmath.com. We are the controller of the personal information described here. Reach us at hello@palletmath.com.
An email address and a password. The password is never stored — only a scrypt hash of it, with a per-account salt. We ask for no name, no postal address, and no payment details; PalletMath is free during the beta and takes no payment information at all.
The working data of a pallet buyer: manifests you upload or scan, your freight and fee assumptions, the marketplaces you buy from, what you paid, what arrived when you checked the pallet in, and what you eventually sold items for. This is the material the score is computed from. It belongs to you.
Connecting eBay is optional and off unless you start it. The grant we request is read-only order data (sell.fulfillment.readonly) and nothing else — we cannot list, sell, message, or change anything in your account.
From each order we store only the commercial facts needed to measure what a pallet actually recovered:
| Stored | Never stored |
|---|---|
| Order and line identifiers, item title, SKU, quantity, gross amount, shipping charged, marketplace fees, sale date | Buyer names, buyer usernames, shipping or billing addresses, buyer email addresses or phone numbers, payment or card details, messages |
This is not a policy we apply on top of the data — the import discards buyer fields before anything is written. eBay granted PalletMath an exemption from its Marketplace Account Deletion notification workflow on exactly this basis: we hold no eBay user data to delete. You can disconnect at any time, which deletes the stored token, and you can revoke the grant independently from your eBay account settings.
If you join the waitlist we store the email address you gave and which form you used, so we can write to you once. That is separate from an account and creates no account.
No advertising trackers, no analytics scripts, no third-party cookies, no device fingerprinting, no location data. Signed-in sessions use a bearer token your browser holds, not a tracking cookie. Our server keeps ordinary operational logs of requests and errors.
One genuine exception to name: our pages load web fonts from Google Fonts, so your browser makes a request to fonts.googleapis.com and fonts.gstatic.com, which reveals your IP address to Google. We mention it because it is the only third-party request our pages make.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
PalletMath gets better as buyers report what pallets really recovered. Those reports are pooled — but a seller's realized prices are their margin, so pooling has to be genuinely anonymous rather than nominally so.
A benchmark figure is published only when the group behind it clears both of two thresholds: at least 20 sales, and those sales from at least 3 different sellers. The second is the one that matters. Twenty sales from one seller is still one seller's book, readable by anyone who can do arithmetic.
What gets published is a median ratio of proceeds to retail for a category and condition. Never a price, never an item, never a lot, never a seller. Groups that have not yet cleared the thresholds are shown as pending with a count, so coverage is never made to look more complete than it is.
| Service | What it receives | Why |
|---|---|---|
| Keepa | Product codes (UPC/ASIN) from manifests. Not your identity, not your lot, not your bid. | Market price history for items on a pallet |
| eBay | Only your own authorisation, and only if you connect it | Reading your completed orders |
| Resend | Your email address and the message | Sending account and beta email |
| Fly.io | Hosts the application and its database | Running the service |
| Google Fonts | Your IP address, when a page loads | Typefaces |
Each is a service provider acting on our instructions. None of them is given your data to use for their own purposes.
Traffic is HTTPS only. Passwords are stored as salted scrypt hashes and are not recoverable, by us or anyone else. Access to the production database is limited to the operator of the LLC.
If you connect eBay, the read-only token that permits ongoing access is encrypted before it is written down, with AES-256-GCM and a key that is not kept in the database. A copy of the database on its own — a backup, a snapshot, a dumped table — does not yield your token, because the file and the key are deliberately kept in two different places.
What that does not protect against, said plainly: anyone who compromises the running server has the key, because the server must hold it to do its job. Defending against that would need a separate key-management service, and we would rather tell you where the limit is than let “encrypted” imply more than it does. You can use every other part of PalletMath without connecting eBay, and you can revoke a grant at any moment from your eBay account settings.
No system is perfectly secure, and we would rather tell you where the soft edge is than imply there isn't one.
Account and pallet data is kept while your account exists, because its value is the history. Delete your account and we delete your account record, manifests, scores, purchases, check-ins and sales within 30 days, and sooner where we can.
Two things survive deletion, and neither identifies you: aggregate benchmark figures already computed from pooled data, which cannot be traced back to a person, and ordinary backups, which age out on their own schedule. Waitlist addresses are removed on request.
Write to hello@palletmath.com and we will answer within 30 days. We will not charge you for a request, and we will not treat you differently for making one. Depending on where you live you may have additional statutory rights; ask and we will honour them.
Not for children. PalletMath is a tool for businesses buying wholesale liquidation. It is not directed at anyone under 18 and we do not knowingly collect their information.
Where data lives. Our servers and service providers are in the United States. If you use PalletMath from elsewhere, your information is processed in the US.
Changes. If we change this policy we will change the effective date above, and we will email account holders before anything material takes effect rather than changing it quietly.
Governing law. This policy is governed by the laws of the Commonwealth of Pennsylvania.